Third-party access token validator

PingDirectory Administration Guide

Introduction to the PingDirectory server
Server features
Administration framework
Server tools location
Installing the PingDirectory server
Prepare your environment
System requirements
Installing Java
Preparing the operating system (Linux)
Configuring the file descriptor limits
Tuning the file system
Setting the file system flushes
Setting noatime on ext3 and ext4 Systems
Setting the maximum user processes
About editing OS-level environment variables
Installing sysstat and pstack (Red Hat)
Installing dstat (SUSE Linux)
Disabling file system swapping
Adjusting system memory allocation
Omitting vm.overcommit_memory
Managing system entropy
Setting file system event monitoring (inotify)
Tuning the I/O scheduler
Running as a non-root user (Linux)
Enabling the server to listen on privileged ports (Linux)
Getting the installation packages
Directory server folder layout
make-ldif template format
Server installation modes
Before you begin
Ping Identity license keys
Installing the server in interactive mode
Installing the server in non-interactive mode
Installing the server in non-interactive mode
Installing the server in non-interactive mode with a truststore
Installing a lightweight server
Deploying the administrative console
Using Docker to run a standalone administrative console
Docker server profiles
Installing the server on Windows
Signing on to the administrative console
Setting the administrative console session timeout window
Configuring the administrative console
Setting up the administrative console on a Tomcat environment
Configuring PingDirectory server to disable the embedded administrative console
The administrative console’s application.yml configuration file
Selecting servers to manage in the administrative console
Uninstalling the server
Uninstalling the server in interactive mode
Uninstalling the server in non-interactive mode
Uninstalling selected components in non-interactive mode
Upgrading the PingDirectory server
Upgrade overview and considerations
Upgrade considerations introduced in PingDirectory 9.x
Upgrade considerations introduced in PingDirectory 8.x
Upgrading servers in a topology
Restoring a mixed topology to a clean state
Upgrading the PingDirectory server
Reverting an update
Getting started with server
Multiple backends
Importing data
Generating sample data
Importing data on the server using offline import
Running the server
Starting the server
Running the server as a foreground process
Starting the PingDirectory server at boot time
Stopping the server
Scheduling a server shutdown
Restarting the server
Running the server as a Microsoft Windows service
Registering the server as a Windows service
Running multiple service instances
Deregistering and uninstalling services
Configuring log files for services
Running the status tool
Tuning the server
About minimizing disk access
Memory allocation and database cache
server process memory
Determining heap and database cache size
Automatic DB cache percentages
Automatic memory allocation
Automatic memory allocation for the command-line tools
Database preloading
Configuring database preloading
Configuring database preloading
Configuring multiple preloading methods
Configuring system index preloading
Databases on storage area networks, network-attached storage, or running in virtualized environments
Database cleaner
Compacting common parent DNs
Setting the import thread count
JVM properties for server and command-line tools
Applying changes using dsjavaproperties
Updating the Java version in the properties file
Regenerating the Java properties file
Tuning for disk-bound deployments
Uncached attributes and entries
Configuring uncached attributes and entries
JVM garbage collection using CMS
Determining the CMSInitiatingOccupancyFraction
JVM garbage collection using ZGC
Configuring the PingDirectory server
About the configuration tools
About the dsconfig configuration tool
Using dsconfig in interactive command-line mode
Configuring the server using dsconfig interactive mode
Viewing dsconfig advanced properties
Changing the dsconfig object menu
dsconfig interactive administrative alerts
Using dsconfig in non-interactive mode
Configuring the Server using dsconfig non-interactive mode
Viewing a list of dsconfig properties
Getting the equivalent dsconfig non-interactive mode command
Using dsconfig batch mode
Using the PingDirectory server or the PingDirectoryProxy server with PingFederate OAuth tokens
About recurring tasks and task chains
Creating a recurring task and task chain
LDIF export as a recurring task
Lockdown mode as a recurring task
File retention recurring task
Using exec tasks
Using custom rebranding
Customizing text information
Customizing the color scheme or logos
Customizing the page icon
Topology configuration
Topology primary requirements and selection
Topology components
Monitor data for the topology
Servers and certificates
Listener certificates
Replacing listener certificates
Inter-server certificates
Replacing the inter-server certificate
X.509 certificates
Certificate subject DNs
Certificate key pairs
Certificate extensions
Certificate chains
About representing certificates, private keys, and certificate signing requests
Certificate trust
Keystores and truststores
Transport Layer Security (TLS)
TLS handshakes
Key agreement
LDAP StartTLS extended operation
The manage-certificates tool
Available subcommands
Common arguments
Listing the certificates in a keystore
Generating self-signed certificates
Generating certificate signing requests
Importing signed and trusted certificates
Exporting certificates
Using manage-certificates as a simple certification authority
Enabling TLS support during setup
Enabling TLS support after setup
Configuring key and trust manager providers
Configuring connection handlers
Updating the topology registry
Troubleshooting TLS-related issues
Log messages
manage-certificates check-certificate-usability
ldapsearch
Using low-level TLS debugging
Using the Configuration API
Authentication and authorization with the Configuration API
The Configuration API and the dsconfig tool relationship
GET example
GET list example
PATCH example
Configuration API paths
Sort and filter objects
Update properties
Administrative actions
Updating servers and server groups
Configuration API responses
Configuring the server using the administrative console
Signing on to the administrative console
Configuring the server using the console
Generating a summary of configuration components
Administrator account classes
Using separate administrator accounts
Unpredictable identifiers for server administrators
Secure communication for server administrators
Managing root user accounts
Default root privileges
Configuring administrator accounts
Setting up a single administrator account
Changing the administrator password
Setting up an administrator group
Configuring a global administrator
Creating a global administrator
Removing a global administrator
Configuring server groups
Client connection policy configuration
About the client connection policy
When a client connection policy is assigned
Restricting the type of search filter used by clients
Resource limits
Defining the operation rate
Client connection policy deployment example
Define the connection policies
How the policy is evaluated
Configuring a client connection policy using the console
Configuring a client connection policy using dsconfig
Restricting server access based on client IP address
Restricting server access using the connection handlers
Restricting server access using client connection policies
Automatically authenticating clients that have a secure communication channel
Securing the Server with lockdown mode
Entering lockdown mode manually
Leaving lockdown mode
Starting a server in lockdown mode
Configuring maximum shutdown time
About working with referrals
Specifying LDAP URLs
Creating referrals
Modifying a referral
Deleting a referral
Configuring a read-only server
Configuring HTTP access for the PingDirectory server
Configuring HTTP Servlet Extensions
Configuring web application servlet extensions
Configuring Java-based servlet extensions
Configuring Groovy-scripted extensions
Configuring HTTP operation loggers
Example HTTP log publishers
Configuring HTTP connection handlers
Configuring an HTTP connection handler
Configuring an HTTP connection handler for web applications
HTTP correlation IDs
Configuring HTTP correlation ID support
HTTP correlation ID example
Configuring the PingDirectory server to use an HTTP proxy server
Creating an HTTP proxy external server
Configuring server components to use the HTTP proxy external server
DNS caching
IP address reverse name lookups
Configuring traffic through a load balancer
Configuring traffic through a load balancer using dsconfig
Configuring traffic through a load balancer using the administrative console
Working with the Referential Integrity plugin
Working with the Unique Attribute plugin
Working with the Purge Expired Data plugin
Configuring the Purge Expired Data plugin for expired entries
Configuring the Purge Expired Data plugin for expired attribute values
Configuring uniqueness across attribute sets
Working with the Last Access Time plugin
Working with pass-through authentication
Configuring pass-through authentication to LDAP servers
The PingOne Pass-Through Authentication plugin
Configuring pass-through authentication to custom services
Troubleshooting server performance issues
Slow password storage schemes
Database size versus memory capacity
Large number of access control rules
Large static groups
Large index ID sets
Missing indexes
Configuring the server for Oracle compatibility
Supporting unindexed search requests
Syncing passwords to PingOne
Single sign-on with the PingDirectory server administrative console
Setting up SSO to PingDirectory from PingOne
Setting up SSO to PingDirectory from a generic OpenID Connect provider
Configuring Soft Deletes
About soft deletes
General tips on soft deletes
Configuring soft deletes on the server
Configuring soft deletes as a global configuration
Configuring a user to use soft or hard delete controls
Searching for soft deletes
Running a base-level search on a soft-deleted entry
Running a filtered search by soft-delete-entry object class
Running a search using the soft delete entry access control
Undeleting a soft-deleted entry using the same RDN
Undeleting a soft-deleted entry using a new RDN
Modifying a soft-deleted entry
Hard deleting a soft-deleted entry
Hard deleting a soft-deleted entry (global configuration)
Hard deleting a soft-deleted entry (connection or request criteria)
Configuring soft deletes by connection criteria
Enabling soft deletes by connection criteria
Disabling soft deletes by connection criteria
Configuring soft deletes by request criteria
Enabling soft deletes by request criteria
Disabling soft deletes by request criteria
Configuring soft-delete automatic purging
Configuring soft-delete automatic purging
Disabling soft-delete automatic purging
Soft and hard delete processes
Soft delete controls and tool options
Monitoring soft deletes
New monitor entries
Monitoring soft deletes
Access logs
Audit logs
Configuring the file-based audit log for soft deletes
Changelog
Configuring soft deletes on the changelog backend
Disabling soft deletes as a global configuration
Importing and exporting data
Importing data
Validating an LDIF file
About the database cache estimate
Tracking skipped and rejected entries
Running an offline import
Performing an offline import
Performing an offline LDIF import using a compressed file
Performing an offline LDIF import using a MakeLDIF template
Running an online LDIF import
Performing an online LDIF import
Scheduling an online import
Canceling a scheduled import
Adding entries to an existing server
Filtering data import
Exporting data
Performing an export
Performing an export from specific branches
Encrypting LDIF exports and signing LDIF files
Encrypting an LDIF export
Importing an encrypted LDIF file
Signing an export
Importing a signed LDIF file
Filtering data exports
Scrambling data files
Backing up and restoring data
About backing up and restoring data
Retaining backups
Listing the available backups on the system
Backing up all backends
Backing up a single backend
Performing an offline restore
Assigning an ID to a backup
Scheduling an online backup
Scheduling an online restore
Encrypting a backup
Signing a hash of the backup
Restoring a backup
Moving or restoring a user database
Comparing the data in two servers
Comparing two servers using ldap-diff
Comparing configuration entries using config-diff
Comparing entries using source and target DN files
Comparing servers for missing entries only using ldap-diff
Reverting or replaying changes
Working with groups
Overview of groups
About the isMemberOf and isDirectMemberOf virtual attribute
Using static groups
Creating static groups
Creating a static group
Adding a new member to a static group
Removing a member from a static group
Searching static groups
Determining if a user is a static group member
Determining the static groups to which a user belongs
Determining the members of a static group
Using dynamic groups
Creating dynamic groups
Searching dynamic groups
Determining if a user is a dynamic group member
Determining the dynamic groups to which a user belongs
Determining the members of a dynamic group
Using dynamic groups for internal operations
Using virtual static groups
Creating virtual static groups
Searching virtual static groups
Creating nested groups
Maintaining referential integrity with static groups
Monitoring the group membership cache
Using the entry cache to improve the performance of large static groups
Enabling the entry cache
Creating your own entry cache for large groups
Monitoring the entry cache
Tuning the index entry limit for large groups
Summary of commands to search for group membership
Migrating Oracle groups
Migrating static groups
Migrating static groups to virtual static groups
Migrating dynamic groups
Working with indexes
Overview of indexes
General tips on indexes
Index types
System indexes
Viewing the system indexes
Managing local DB indexes
Viewing the list of local DB indexes
Viewing a property for all local DB indexes
Viewing the configuration parameters for local DB index
Modifying the configuration of a local DB index
Creating a new local DB index
Deleting a local DB index
Composite indexes
JSON indexes
Working with local DB VLV indexes
Viewing the list of local DB VLV indexes
Creating a new local DB VLV index
Modifying a VLV index's configuration
Rebuilding a VLV index
Deleting a VLV index
Working with filtered indexes
Creating a filtered index
Tuning indexes
About the exploded index format
About monitoring index entry limits
About the dbtest Index Status table
Configuring the index properties
About the Index Summary Statistics table
Managing entries
Searching entries
Searching the root DSE
Searching all entries in the server
Searching for an access control instruction
Searching for the schema
Searching for a single entry using base scope and base DN
Searching for a single entry using the search filter
Searching for all immediate children for restricted return values
Searching for all children of an entry in sorted order
Limiting the number of returned search entries and search time
Getting information about how indexes are used in a search operation
Working with the matching entry count control
Adding entries
Adding an entry using an LDIF file
Adding an entry using the changetype LDIF directive
Adding multiple entries in a single file
Deleting entries using ldapdelete
Deleting an entry using ldapdelete
Deleting multiple entries using an LDIF file
Deleting entries using ldapmodify
Modifying entries using ldapmodify
Modifying an attribute from the command line
Modifying multiple attributes in an entry from the command line
Adding an attribute from the command line
Adding an attribute using the language subtype
Adding an attribute using the binary subtype
Deleting an attribute
Deleting one value from an attribute with multiple values
Renaming an entry
Moving an entry within a server
Moving an entry from one machine to another
Moving multiple entries from one machine to another
Working with the parallel-update tool
Running the parallel-update tool
Working with the watch-entry Tool
Working with LDAP transactions
Requesting a batched transaction using ldapmodify
Working with virtual attributes
Viewing the list of default virtual attributes
Viewing the list of default virtual attributes using dsconfig non-interactive mode
Viewing virtual attribute properties
Enabling a virtual attribute
Enabling a virtual attribute using dsconfig interactive mode
Enabling a virtual attribute using dsconfig non-interactive mode
Creating user-defined virtual attributes
Creating a user-defined virtual attribute in interactive mode
Creating a user-defined virtual attribute using dsconfig in non-interactive mode
Creating mirror virtual attributes
Creating a mirror virtual attribute using dsconfig in non-interactive mode
Editing a virtual attribute
Editing a virtual attribute using dsconfig in non-interactive mode
Deleting a virtual attribute
Working with composed attributes
Virtual attribute limitations
Performance limitations
Indexing limitations
Unexpected behavior for write operations
Overview of composed attributes
Composed attribute plugin configuration properties
Populate composed attribute values task
Composed attribute dependency considerations
Schema validation considerations
Replication considerations
Synchronization server considerations
server considerations
Troubleshooting considerations
Security considerations
Limitations of composed attributes relative to virtual attributes
Encrypting sensitive data
About encrypting and protecting sensitive data
About the Encryption-Settings Database
Supported Encryption Ciphers and Transformations
Using the encryption-settings Tool
Creating encryption-settings definitions
Changing the preferred encryption-settings definition
Deleting an encryption-settings definition
Configuring the encryption-settings database
Encrypting passphrase files
About backing up and restoring the encryption-settings definitions
Exporting encryption-settings definitions
Importing encryption-settings definitions
Enabling data encryption in the server
Using data encryption in a replicated environment
Dealing with a compromised encryption key
Configuring sensitive attributes
Creating a sensitive attribute
Configuring global sensitive attributes
Excluding a global sensitive attribute on a client connection policy
Working with the LDAP changelog
Overview of the LDAP changelog
Key changelog features
Enabling access control filtering in the LDAP changelog
Useful changelog features
Example of the changelog features
Viewing the LDAP changelog properties
Viewing the LDAP changelog properties using dsconfig non-interactive mode
Enabling the LDAP changelog
Enabling the LDAP changelog using dsconfig non-interactive mode
Enabling the LDAP changelog using interactive mode
Changing the LDAP changelog database location
Changing the LDAP changelog location using dsconfig non-interactive mode
Resetting the LDAP changelog location using dsconfig non-interactive mode
Viewing the LDAP changelog parameters in the Root DSE
Viewing the LDAP changelog using ldapsearch
Viewing the LDAP changelog using ldapsearch
Viewing the LDAP change sequence numbers
Viewing LDAP changelog monitoring information
Indexing the LDAP changelog
Indexing a changelog attribute
Excluding attributes from indexing
Tracking virtual attribute changes in the LDAP changelog
Managing access control
Overview of access control
Key access control features
Improved validation and security
Global ACIs
Access controls for public or private backends
General format of the access control rules
Summary of access control keywords
Targets
Permissions
Bind rules
Access token validators
Access token validator processing
Access token validator types
Configuring a sample PingFederate access token validator
JWT access token validator
Handling signed tokens
Example: Use a locally configured trusted certificate
Example: Use the issuer's JWKS endpoint
Handling encrypted tokens
Mock access token validator
Third-party access token validator
Working with targets
target
targetattr
targetfilter
targattrfilters
targetscope
targetcontrol
extOp
Examples of common access control rules
Administrator access
Anonymous and authenticated access
Delegated access to a manager
Proxy authorization
Validating ACIs before migrating data
Validating ACIs from a file
Validating ACIs in another directory server
Migrating ACIs from Oracle to the server
Support for macro ACIs
Support for the roleDN bind rule
Targeting operational attributes
Specification of global ACIs
Defining ACIs for non-user content
Limiting access to controls and extended operations
Tolerance for malformed ACI values
About the privilege subsystem
Identifying unsupported ACIs
Working with privileges
Available privileges
Privileges automatically granted to root users
Assigning additional privileges for administrators
Assigning privileges to normal users and individual root users
Disabling privileges
Working with proxied authorization
Configuring proxied authorization
Restricting proxy users
About the ds-auth-may-proxy-as-* operational attributes
About the ds-auth-is-proxyable-* operational attributes
Restricting proxied authorization for specific users
Working with parameterized ACIs
$attr.attrName macro
Managing the schema
About the schema
About the Schema Editor
Default server schema files
Extending the server schema
General tips on extending the schema
About managing attribute types
Attribute type definitions
Basic properties of attributes
Viewing attributes
Viewing attribute types using the Schema Editor
Viewing attribute types over LDAP
Viewing a specific attribute type over LDAP
Creating a new attribute over LDAP
Adding a new attribute to the schema over LDAP
Adding constraints to attribute types
Managing object classes
Object classes types
Object class definition
Basic object class properties
Viewing object classes
Managing an object class over LDAP
Creating a new object class using the Schema Editor
Extending the schema using a custom schema file
About managing matching rules
Matching rule definition
Default matching rules
Basic matching rule properties
Viewing matching rules
About managing attribute syntaxes
Attribute syntax definition
Default attribute syntaxes
Basic attribute syntax properties
Viewing attribute syntaxes
Using the Schema Editor utilities
Modifying a schema definition
Deleting a schema definition
Managing schema checking
Viewing the schema checking properties
Disabling schema checking
Managing matching rule uses
Matching rule use definitions
Viewing matching rule uses
Managing DIT content rules
DIT content rule definitions
Viewing DIT content rules
Managing name forms
Name form definitions
Viewing name forms
Managing DIT structure rules
DIT structure rule definition
Viewing DIT structure rules
About managing JSON attribute values
Configuring JSON attribute constraints
Adding constraints to JSON attributes
Managing password policies
Viewing password policies
Viewing password policies
Viewing a specific password policy
About the password policy properties
Access log
Replication considerations
Get Recent Login History control
Modifying an existing password policy
Creating new password policies
Creating a new password policy
Assigning a password policy to an individual account
Assigning a password policy using a virtual attribute
Deleting a password policy
Modifying a user's password
Validating a password
Retiring a password
Changing a user's password using the Modify operation
Changing a user's password using the Password Modify extended operation
Using an automatically-generated password
Enabling YubiKey authentication
Enabling social sign-on
Managing user accounts
Returning the password policy state information
Determining whether an account is disabled
Disabling an account
Enabling a disabled account
Assigning the manage-account access privileges to non-root users
Disabling password policy evaluation
Globally disabling password policy evaluation
Exempting a user from password policy evaluation
Managing password validators
Password validators
Configuring password validators
Viewing the list of defined password validators
Configuring the Attribute Value Password Validator
Configuring the Character Set Password Validator
Configuring the Length-Based Password Validator
Configuring the Pwned Passwords Password Validator
Configuring the Regular Expression Password Validator
Configuring the Repeated Character Password Validator
Configuring the Similarity-Based Password Validator
Configuring the Unique Characters Password Validator
Managing replication
Overview of replication
Replication versus synchronization
Replication terminology
Replication architecture
Eventual consistency
Replicas and replication servers
Authentication and authorization
Logging
Replication deployment planning
Location
User-defined LDAP
Disk space
Memory
Time synchronization
Communication ports
Hardware load balancers
PingDirectoryProxy
Displaying the server information for a replication deployment
Displaying all status information for a replication deployment
Enabling replication
Overview
Command-line interface
What happens when you enable replication
Initialization
Replica generation ID
Deploying a basic replication topology
Example deployment with non-interactive dsreplication
Deploying with non-interactive dsreplication
Using dsreplication with SASL GSSAPI (Kerberos)
Configuring assured replication
About the Replication Assurance Policy
About assured replication
Configuring assured replication
About the assured replication controls
Managing the topology
Adding a server to the topology
Disabling replication and removing a server from the topology
Replacing the data for a replicating domain
Advanced configuration
Changing the replicationChanges DB Location
Modifying the replication purge delay
Configuring a single listener-address for the replication server
Monitoring replication
Monitoring replication using cn=monitor
Replication best practices
Purging obsolete replicas
About the dsreplication command-line utility
Replication conflicts
Types of replication conflicts
Naming conflict scenarios
Modification conflict scenarios
Troubleshooting replication
Recovering a replica with missed changes
Performing a manual initialization
Fixing replication conflicts
Fixing a modify conflict
Fixing a naming conflict
Fixing mismatched generation IDs
Replication reference
Summary of the dsreplication Subcommands
Summary of the Direct LDAP Monitor information
Summary of the Indirect LDAP Server Monitor information
Summary of the Remote Replication Server Monitor information
Summary of the Replica Monitor information
Summary of the Replication Server Monitor information
Summary of the Replication Server Database Monitor information
Summary of the Replication Server Database Environment Monitor information
Summary of the Replication Summary Monitor information
Summary of the replicationChanges Backend Monitor information
Summary of the Replication Protocol Buffer Monitor information
Advanced topics reference
About the replication protocol
Change number
Conflict resolution
WAN-friendly replication
WAN Gateway Server
WAN message routing
WAN Gateway Server selection
WAN replication in mixed-version environments
Recovering a replication changelog
Performing disaster recovery
Managing logging
Default server logs
Types of log publishers
Viewing the list of log publishers
Enabling or disabling a default log publisher
Managing access and error log publishers
Managing file-based access log publishers
Access log format
Access log example
Modifying the access log using dsconfig interactive mode
Modifying the access log using dsconfig non-interactive mode
Modifying the maximum length of log message strings
Disabling logging of inter-server periodic search requests
Generating access log summaries
About log compression
About log signing
About encrypting log files
Configuring log signing
Validating a signed file
Configuring log file encryption
Log sanitization
Log sanitization options
Customizing log field syntaxes
Customizing log field behaviors
Creating new log publishers
Creating a new log publisher
Creating a log publisher using dsconfig interactive command-line mode
Configuring log rotation
Configuring log rotation listeners
Configuring log retention
Configuring filtered logging
Managing Admin Alert Access Logs
About access log criteria
Configuring an Admin Alert Access Log publisher
Managing the Syslog-Based Access Log Publishers
Before you begin
Logging with syslog
Default access log severity level
syslog-facility properties
queue-size property
Configuring a Syslog-Based Access Log Publisher
Managing the File-Based Audit Log Publishers
Audit log format
Audit log example
Enabling the File-Based Audit Log Publisher
Obscuring values in the audit log
Managing the JDBC Access Log Publishers
Before you begin
Configuring the JDBC drivers
Configuring the log field mapping tables
Configuring the JDBC Access Log Publisher using dsconfig interactive mode
Configuring the JDBC Access Log Publisher using dsconfig non-interactive mode
Managing the File-Based Error Log Publisher
Error log example
Modifying the File-Based Error Logs
Managing the Syslog-Based Error Log Publisher
Syslog error mapping
Configuring a Syslog-Based Error Log Publisher
Creating File-Based Debug Log Publishers
Creating a File-Based Debug Log Publisher
Deleting a File-Based Debug Log Publisher
Managing monitoring
The monitor backend
Monitoring disk space usage
Monitoring with the PingDataMetrics server
About the collection of system monitoring data
Monitoring key performance indicators by application
Configuring the external servers
Preparing the servers monitored by the PingDataMetrics server
Configuring the Processing Time Histogram plugin
Setting the connection criteria to collect SLA statistics by application
Proxy considerations for tracked applications
Monitoring using SNMP
SNMP implementation
Configuring SNMP
MIBS
Monitoring with the administrative console
Accessing the Processing Time Histogram
Monitoring with JMX
Running JConsole
Monitoring the server using JConsole
Monitoring using the LDAP SDK
Monitoring over LDAP
Profiling server performance using the Stats Logger
Enabling the Stats Logger
Configuring multiple Periodic Stats Loggers
Enabling and configuring the StatsD monitoring endpoint
Enabling and configuring the Stats Collector Plugin
Adding custom logged statistics to a Periodic Stats Logger
Configuring a custom logged statistic using dsconfig interactive
Configuring a custom stats logger using dsconfig non-interactive
Updating the Global Configuration
Monitoring PingDirectory metrics with Splunk
Sending PingDirectory metrics with StatsD
Configuring a StatsD monitoring endpoint
Configuring Splunk to receive StatsD metrics
Sending Metrics with the Periodic Stats Logger and the Splunk Universal Forwarder
Configuring the Periodic Stats Logger
Configuring the Splunk Universal Forwarder
Using the server app for Splunk
Monitoring server metrics with Prometheus
Enabling Prometheus support in the server
Customizing published metrics
Consuming metrics with Prometheus
Managing notifications and alerts
Account status notifications
Account status notification types
Working with the Error Log Account Status Notification Handler
Disabling the Error Log Account Status Notification Handler
Removing a notification type from the Error Log Handler
Working with the SMTP Account Status Notification Handler
Configuring the SMTP server
Configuring a StartTLS connection to the SMTP server
Configuring an SSL connection to the SMTP server
Enabling the SMTP account status notification handler
Viewing the account status notification handlers
Associating account status notification handlers with password policies
Administrative alert handlers
Administrative alert types
Configuring the JMX connection handler and alert handler
Configuring the JMX connection handler
Configuring the JMX alert handler
Configuring the SMTP alert handler
Configuring the SNMP subagent alert handler
Email account status notification handler
Account status notification types
Message template file format
Customizing the message content
Working with the Alerts Backend
Viewing information in the Alerts Backend
Modifying the alert retention time
Configuring duplicate alert suppression
Working with alarms, alerts, and gauges
Viewing information in the Alarms Backend
Testing alerts and alarms
Testing alarms and alerts
Indeterminate alarms
Managing SCIM servlet extensions
SCIM 1.1 and 2.0 servlet extensions management
Overview of SCIM 1.1 fundamentals
Summary of SCIM 1.1 protocol support
The Identity Access API
Configuring SCIM 1.1
Creating your own SCIM 1.1 application
Configuring the SCIM 1.1 servlet extension
Configuring SCIM manually
Enabling resource versioning
Configuring the SCIM servlet extension using the batch script
SCIM 1.1 servlet extension authentication
Configuring basic authentication using an identity mapper
Enabling OAuth authentication
Verifying the SCIM 1.1 servlet extension configuration
Configuring the Identity Access API
Configuring the Identity Access API
Disabling core SCIM resources
Verifying the Identity Access API configuration
Monitoring the SCIM servlet extension
Testing SCIM query performance
Monitoring resources using the SCIM extension
About the HTTP log publishers
Configuring advanced SCIM 1.1 extension features
Managing the SCIM 1.1 schema
About the SCIM schema
Mapping the LDAP schema to the SCIM resource schema
About the resource element
About the attribute element
About the simple element
About the complex element
About the simpleMultivalued element
About the complexMultiValued element
About the subAttribute element
About the canonicalValue element
About the mapping element
About the subMapping element
About the LDAPSearch element
About the resourceIDMapping element
About the LDAPAdd element
About the fixedAttribute element
Validating the updated SCIM schema
Mapping SCIM resource IDs
Using pre-defined transformations
Mapping LDAP entries to SCIM using the SCIM-LDAP API
SCIM authentication
SCIM logging
SCIM monitoring
Managing the SCIM 2.0 servlet extension
Supported SCIM 2.0 endpoints
Configuring SCIM 2.0 on your server
Creating your own SCIM 2.0 application
Authentication requirements for SCIM 2.0 requests
Defining permissions for SCIM 2.0 requests
Enabling user mapping for SCIM 2.0 operations
SCIM 2.0 components
Correlated LDAP data views
Configuring an LDAP Mapping SCIM 2.0 resource type
Configuring a correlated LDAP data view
Configuring permissions for SCIM 2.0 operations
SCIM 2.0 searches
Using paged SCIM searches
SCIM 2.0 PATCH operations
Troubleshoot the SCIM 2.0 servlet extension
Disabling the SCIM 2.0 servlet extension
Troubleshooting a multiple correlation entry error
Managing the Directory REST API
Managing Server SDK extensions
About the Server SDK
Available types of extensions
DevOps and infrastructure as code
Limitations when automating server deployments
Server profiles
Variable substitution
Profile structure
setup-arguments.txt
dsconfig/
server-root/
ldif/
server-sdk-extensions/
variables-ignore.txt
server-root/permissions.properties
misc-files/
About the manage-profile tool
manage-profile generate-profile
manage-profile setup
manage-profile replace-profile
Server profiles in a pets service model
Topology-management tools
Deployment automation
Setting up the initial topology
Prefer topology administrator accounts over root users
Initializing data on all servers
Replacing crashed instances and scaling up
Scaling down
Rolling updates
Troubleshooting the PingDirectory server
PingDirectory server gauges
Working with the collect-support-data tool
Server commands used in the collect-support-data tool
JDK commands used in the collect-support-data tool
Linux commands used in the collect-support-data tool
MacOS commands used in the collect-support-data tool
Invoking the collect-support-data tool as an administrative task
Available tool options
Running the collect-support-data tool
PingDirectory server troubleshooting information
Error log
server.out log
Debug log
Replication repair log
Config audit log and the configuration archive
Access and audit log
Setup log
Tool log
je.info and je.config files
LDAP SDK debug log
About the monitor entries
PingDirectory server troubleshooting tools
Server version information
LDIF connection handler
dbtest tool
Index key entry limit
Embedded profiler
Invoking the profile viewer in text-based mode
Invoking the profile viewer in GUI mode
Oracle Berkeley DB Java Edition utilities
Troubleshooting resources for Java applications
Java troubleshooting tools
jps
jstack
jmap
jhat
jstat
Java diagnostic information
JVM crash diagnostic information
Troubleshooting resources in the operating system
Identifying problems with the underlying system
Examining CPU utilization
System-Wide CPU utilization
Per-CPU utilization
Per-process utilization
Examining disk utilization
Examining process details
ps
pstack
dbx / gdb
pfiles / lsof
Tracing process execution
Problems with SSL communication
Examining network communication
Common problems and potential solutions
General troubleshooting methodology
The server will not run setup
A suitable Java environment is not available
Oracle Berkeley DB Java Edition is not available
Unexpected arguments provided to the JVM
The server has already been configured or used
The server will not start
The server or other administrative tool is already running
There is not enough memory available
An invalid Java Environment or JVM option was used
An invalid command-line option was provided
The server has an invalid configuration
You do not have sufficient permissions
The server has crashed or shut itself down
Conditions for automatic server shutdown
The server will not accept client connections
The server is unresponsive
The server is slow to respond to client requests
The server returns error responses to client requests
The server must disconnect a client connection
The server is experiencing problems with replication
How to regenerate the server ads-certificate
The server behaves differently from Sun/Oracle
Troubleshooting ACI evaluation
Problems with the administrative console
Problems with the administrative console: JVM memory issues
Problems with the HTTP Connection Handler
Virtual process size on RHEL6 Linux is much larger than the heap
Providing information for support cases
Command-line tools
Available command-line tools
Saving options in a file
Creating a tools properties file
Evaluation of command-line options and file options
Sample dsconfig batch files
Running task-based tools

To create custom access token validators, use the Server SDK.

Page created: 15 Jul 2022 |

Page updated: 15 Jul 2022

Back to home page